Substantial restrictions on how companies handle personal data have been put forward under the draft European Data Protection Regulation, which will shortly be put before the European Parliament.

The proposals would severely curtail the ability of services to claim they have legitimate grounds for collecting, analyzing, or selling the personal data of their users. They also make it far more difficult for services to claim they have a user's consent for processing their data, even where a user has signed up to a site's terms and conditions.